CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Xtreme Scripts Download Manager 1.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code remotely by supplying a malicious URL in the 'root' parameter in several scripts, including download.php and manager.php.
SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
An unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, facilitating spam sending. Details are obtained from third-party information.
SQL injection vulnerability in inc_header.asp in Snitz Forum 3.4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the %strCookieURL%.GROUP parameter in a cookie.
Multiple SQL injection vulnerabilities were found in SelectaPix 1.31. An attacker can remotely execute arbitrary SQL commands via the albumID, imageID, username, and password parameters.
A stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.
An unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via crafted inputs that trigger memory corruption.
A buffer overflow vulnerability exists in the t2p_write_pdf_string function of tiff2pdf in libtiff versions 3.8.2 and earlier. An attacker can exploit a specially crafted TIFF file with a DocumentName tag containing UTF-8 characters, causing a crash and potentially arbitrary code execution.
SQL injection vulnerability in index.php of Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Multiple SQL injection vulnerabilities in myNewsletter 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the UserName parameter in validatelogin.asp or adminlogin.asp.
The IAX2 channel driver (chan_iax2) in Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 has a buffer overflow vulnerability due to incorrect length checking on truncated IAX2 video frames. A remote attacker can exploit this to cause a denial of service (crash) and potentially execute arbitrary code.
In Wikiwig 4.1 and earlier, the file _wk/wk_lang.php contains a PHP remote file inclusion vulnerability. An attacker can exploit the WK[wkPath] parameter to execute arbitrary PHP code from an external source.
SQL injection vulnerability in index.php of Kmita FAQ 1.0. Remote attackers can execute arbitrary SQL commands via the catid parameter.
SQL injection vulnerability in newscomments.php of Alex News-Engine version 1.5.0 and earlier. Remote attackers can execute arbitrary SQL commands via the newsid parameter.
A stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier allows remote attackers to execute arbitrary code via a crafted svc_download command with compressed data that triggers the overflow during expansion.
PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the include_prefix parameter in inc/dbase.php, inc/config.php, inc/common.php, and inc/function.php. This issue only applies in certain environments or configurations where the inc directory is not protected by a .htaccess file.
In DokuWiki 2006/06/04 and earlier, the spellchecker (spellcheck.php) allows remote attackers to inject and execute arbitrary PHP code via complex curly syntax processed by preg_replace with the /e (executable) modifier.
SQL injection vulnerability in index.php of xueBook 1.0 allows remote attackers to execute arbitrary SQL commands via the 'start' parameter.
A PHP remote file inclusion vulnerability in includes/common.php of gnopaste 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
SQL injection vulnerability in comment.php of Pineapple Technologies Lore 1.5.6 and earlier allows remote attackers to execute arbitrary SQL commands via the article_id parameter.